feat: add security audit automation scripts and detailed vulnerability documentation
هذا الالتزام موجود في:
311
Scripts/adversarial_test_unix.sh
Normal file
311
Scripts/adversarial_test_unix.sh
Normal file
@@ -0,0 +1,311 @@
|
||||
#!/bin/sh
|
||||
BIN="/root/ghaymah-v2-test/gy-linux-amd64"
|
||||
LOGFILE="/root/ghaymah-v2-test/adversarial_test_results.log"
|
||||
TIMEOUT_CMD="timeout 5"
|
||||
|
||||
echo "=====================================================================" > "$LOGFILE"
|
||||
echo " ADVERSARIAL SECURITY TEST SUITE — $(date)" >> "$LOGFILE"
|
||||
echo " Binary: $BIN" >> "$LOGFILE"
|
||||
echo " Note: All tests run OFFLINE with 5s timeout to avoid server hangs" >> "$LOGFILE"
|
||||
echo "=====================================================================" >> "$LOGFILE"
|
||||
|
||||
TOTAL=0
|
||||
PASS=0
|
||||
FAIL=0
|
||||
FINDINGS=""
|
||||
|
||||
log_test() {
|
||||
TOTAL=$((TOTAL + 1))
|
||||
TEST_NAME="$1"
|
||||
EXPECTED="$2"
|
||||
OUTPUT="$3"
|
||||
EXIT_CODE="$4"
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "--- TEST $TOTAL: $TEST_NAME ---" >> "$LOGFILE"
|
||||
echo "Exit Code: $EXIT_CODE" >> "$LOGFILE"
|
||||
echo "Expected: $EXPECTED" >> "$LOGFILE"
|
||||
echo "Output (first 300 chars):" >> "$LOGFILE"
|
||||
printf '%.300s' "$OUTPUT" >> "$LOGFILE"
|
||||
echo "" >> "$LOGFILE"
|
||||
if echo "$OUTPUT" | grep -qiE "(panic|runtime error|segmentation fault|nil pointer dereference|SIGSEGV|goroutine [0-9]+ \[)"; then
|
||||
echo "RESULT: *** CRASH/PANIC DETECTED ***" >> "$LOGFILE"
|
||||
FAIL=$((FAIL + 1))
|
||||
FINDINGS="$FINDINGS\n[CRASH] TEST $TOTAL: $TEST_NAME"
|
||||
else
|
||||
echo "RESULT: No crash (exit $EXIT_CODE)" >> "$LOGFILE"
|
||||
PASS=$((PASS + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
echo "Phase 1/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 1: PATH TRAVERSAL via deploy PATH arg =====" >> "$LOGFILE"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy ../../../etc/passwd --no-auto-update 2>&1)
|
||||
log_test "deploy ../../../etc/passwd" "reject or error" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy /etc/shadow --no-auto-update 2>&1)
|
||||
log_test "deploy /etc/shadow" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy /proc/self/environ --no-auto-update 2>&1)
|
||||
log_test "deploy /proc/self/environ" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --dockerfile ../../../etc/passwd --no-auto-update 2>&1)
|
||||
log_test "dockerfile flag path traversal to /etc/passwd" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --dockerfile /proc/self/cmdline --no-auto-update 2>&1)
|
||||
log_test "dockerfile flag /proc/self/cmdline" "reject" "$OUT" "$?"
|
||||
|
||||
echo "Phase 2/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 2: STDIN / -f flag INJECTION =====" >> "$LOGFILE"
|
||||
|
||||
OUT=$(echo '{"app":"../../etc/passwd","port":8080}' | $TIMEOUT_CMD $BIN deploy -f - --no-auto-update 2>&1)
|
||||
log_test "stdin JSON with traversal app name" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$(echo 'NOT_JSON' | $TIMEOUT_CMD $BIN deploy -f - --no-auto-update 2>&1)
|
||||
log_test "stdin malformed non-JSON" "error gracefully" "$OUT" "$?"
|
||||
|
||||
OUT=$(echo '{"app":"x","port":"NOTANUM"}' | $TIMEOUT_CMD $BIN deploy -f - --no-auto-update 2>&1)
|
||||
log_test "stdin JSON string port" "error gracefully" "$OUT" "$?"
|
||||
|
||||
OUT=$(echo '' | $TIMEOUT_CMD $BIN deploy -f - --no-auto-update 2>&1)
|
||||
log_test "stdin empty input" "error gracefully" "$OUT" "$?"
|
||||
|
||||
echo "Phase 3/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 3: NUMERIC BOUNDARY / OVERFLOW =====" >> "$LOGFILE"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --port 99999999 --no-auto-update 2>&1)
|
||||
log_test "port 99999999 (overflow)" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --port -1 --no-auto-update 2>&1)
|
||||
log_test "port -1 (negative)" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --port 0 --no-auto-update 2>&1)
|
||||
log_test "port 0" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --port 65536 --no-auto-update 2>&1)
|
||||
log_test "port 65536 (above TCP max)" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --port 2147483647 --no-auto-update 2>&1)
|
||||
log_test "port INT32_MAX" "reject" "$OUT" "$?"
|
||||
|
||||
echo "Phase 4/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 4: LONG STRING / BUFFER OVERFLOW =====" >> "$LOGFILE"
|
||||
|
||||
LONG5K=$(dd if=/dev/urandom bs=1 count=5000 2>/dev/null | tr -dc 'a-zA-Z0-9')
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --name "$LONG5K" --no-auto-update 2>&1)
|
||||
log_test "deploy --name 5000 char string" "reject or truncate" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --domain "$LONG5K" --no-auto-update 2>&1)
|
||||
log_test "deploy --domain 5000 char string" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --tier "$LONG5K" --no-auto-update 2>&1)
|
||||
log_test "deploy --tier 5000 char string" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --ai-key "$LONG5K" --no-auto-update 2>&1)
|
||||
log_test "deploy --ai-key 5000 char string" "handle" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN login --email "$LONG5K" --password "$LONG5K" --no-auto-update 2>&1)
|
||||
log_test "login --email/password 5000 chars" "reject" "$OUT" "$?"
|
||||
|
||||
echo "Phase 5/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 5: COMMAND INJECTION VIA FLAGS =====" >> "$LOGFILE"
|
||||
|
||||
for payload in ';id' '$(whoami)' '`id`' '|cat /etc/passwd' '&&ls' '||id'; do
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --name "$payload" --no-auto-update 2>&1)
|
||||
log_test "deploy --name injection: $payload" "not execute cmd" "$OUT" "$?"
|
||||
done
|
||||
|
||||
for payload in ';id' '$(whoami)' '`id`'; do
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --domain "$payload" --no-auto-update 2>&1)
|
||||
log_test "deploy --domain injection: $payload" "not execute cmd" "$OUT" "$?"
|
||||
done
|
||||
|
||||
for payload in ';id' '$(whoami)' '`id`'; do
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --project "$payload" --no-auto-update 2>&1)
|
||||
log_test "deploy --project injection: $payload" "not execute cmd" "$OUT" "$?"
|
||||
done
|
||||
|
||||
echo "Phase 6/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 6: SYMLINK ATTACKS =====" >> "$LOGFILE"
|
||||
|
||||
TMPDIR=$(mktemp -d)
|
||||
ln -sf /etc/passwd "$TMPDIR/Dockerfile"
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy "$TMPDIR" --no-auto-update 2>&1)
|
||||
log_test "deploy dir w/ Dockerfile->symlink /etc/passwd" "not leak file" "$OUT" "$?"
|
||||
|
||||
ln -sf /etc/shadow "$TMPDIR/.env"
|
||||
echo '{}' > "$TMPDIR/.gy.json"
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy "$TMPDIR" --no-auto-update 2>&1)
|
||||
log_test "deploy dir w/ .env->symlink /etc/shadow" "not upload" "$OUT" "$?"
|
||||
|
||||
ln -sf /root "$TMPDIR/subdir"
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy "$TMPDIR" --no-auto-update 2>&1)
|
||||
log_test "deploy dir w/ symlink subdir->root" "not traverse" "$OUT" "$?"
|
||||
rm -rf "$TMPDIR"
|
||||
|
||||
echo "Phase 7/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 7: UNICODE / SPECIAL CHARS =====" >> "$LOGFILE"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --name "تطبيق-عربي" --no-auto-update 2>&1)
|
||||
log_test "deploy --name Arabic chars" "handle" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --name "app%00name" --no-auto-update 2>&1)
|
||||
log_test "deploy --name null byte URL encoding" "handle" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --name '../../../tmp/evil' --no-auto-update 2>&1)
|
||||
log_test "deploy --name path traversal" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --name '"><script>alert(1)</script>' --no-auto-update 2>&1)
|
||||
log_test "deploy --name XSS payload" "handle" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN deploy --name '{{.Env.HOME}}' --no-auto-update 2>&1)
|
||||
log_test "deploy --name Go template injection" "handle" "$OUT" "$?"
|
||||
|
||||
echo "Phase 8/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 8: ENVIRONMENT VARIABLE POISONING =====" >> "$LOGFILE"
|
||||
|
||||
OUT=$(HOME=/tmp $TIMEOUT_CMD $BIN whoami --no-auto-update 2>&1)
|
||||
log_test "whoami with HOME=/tmp" "handle" "$OUT" "$?"
|
||||
|
||||
OUT=$(XDG_CONFIG_HOME=/tmp/evil $TIMEOUT_CMD $BIN whoami --no-auto-update 2>&1)
|
||||
log_test "whoami with XDG_CONFIG_HOME=/tmp/evil" "handle" "$OUT" "$?"
|
||||
|
||||
OUT=$(GY_AI_KEY="malicious-key-value" $TIMEOUT_CMD $BIN deploy --name test --no-auto-update 2>&1)
|
||||
log_test "deploy with GY_AI_KEY env set" "not leak key" "$OUT" "$?"
|
||||
|
||||
echo "Phase 9/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 9: HTTP PROXY MAN-IN-THE-MIDDLE =====" >> "$LOGFILE"
|
||||
|
||||
OUT=$(HTTP_PROXY=http://evil-proxy:8080 HTTPS_PROXY=http://evil-proxy:8080 $TIMEOUT_CMD $BIN login --email test@test.com --password testpass --no-auto-update 2>&1)
|
||||
log_test "login with evil HTTP/HTTPS_PROXY" "check if creds sent to proxy" "$OUT" "$?"
|
||||
|
||||
OUT=$(HTTP_PROXY=http://evil-proxy:8080 HTTPS_PROXY=http://evil-proxy:8080 $TIMEOUT_CMD $BIN whoami --no-auto-update 2>&1)
|
||||
log_test "whoami with evil HTTP_PROXY" "check if token sent to proxy" "$OUT" "$?"
|
||||
|
||||
echo "Phase 10/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 10: CREDENTIAL INPUT ATTACKS =====" >> "$LOGFILE"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN login --email "admin@ghaymah.systems" --password "' OR '1'='1" --no-auto-update 2>&1)
|
||||
log_test "login SQL injection in password" "not succeed" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN login --email '<script>alert(1)</script>' --password test --no-auto-update 2>&1)
|
||||
log_test "login XSS in email" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN login --email "" --password "" --no-auto-update 2>&1)
|
||||
log_test "login empty email+password" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN signup --no-auto-update 2>&1)
|
||||
log_test "signup command without args" "handle" "$OUT" "$?"
|
||||
|
||||
echo "Phase 11/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 11: DELETE COMMAND ABUSE =====" >> "$LOGFILE"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN delete app "../../../etc" --force --no-auto-update 2>&1)
|
||||
log_test "delete app path traversal name" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN delete app "" --force --no-auto-update 2>&1)
|
||||
log_test "delete app empty name" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN delete project "*" --force --no-auto-update 2>&1)
|
||||
log_test "delete project wildcard" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN delete app --force --no-auto-update 2>&1)
|
||||
log_test "delete app no name given" "reject" "$OUT" "$?"
|
||||
|
||||
echo "Phase 12/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 12: TUNNEL ABUSE =====" >> "$LOGFILE"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN tunnel start "evil;id" --port 3000 --no-auto-update 2>&1)
|
||||
log_test "tunnel start injection in name" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN tunnel start test --port 0 --no-auto-update 2>&1)
|
||||
log_test "tunnel start port 0" "reject" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN tunnel start test --port -1 --no-auto-update 2>&1)
|
||||
log_test "tunnel start port -1" "reject" "$OUT" "$?"
|
||||
|
||||
echo "Phase 13/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 13: DEBUG MODE INFORMATION LEAKAGE =====" >> "$LOGFILE"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN whoami --debug --no-auto-update 2>&1)
|
||||
log_test "whoami --debug info leakage" "check secret disclosure" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN config --debug --no-auto-update 2>&1)
|
||||
log_test "config --debug info leakage" "check secret disclosure" "$OUT" "$?"
|
||||
|
||||
echo "Phase 14/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 14: COMPLETION SCRIPT INJECTION =====" >> "$LOGFILE"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN completion bash --no-auto-update 2>&1 | head -n 30)
|
||||
log_test "bash completion script output" "check injection vectors" "$OUT" "$?"
|
||||
|
||||
OUT=$($TIMEOUT_CMD $BIN completion zsh --no-auto-update 2>&1 | head -n 30)
|
||||
log_test "zsh completion script output" "check injection vectors" "$OUT" "$?"
|
||||
|
||||
echo "Phase 15/15 starting..." >&2
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "===== PHASE 15: .gy.json POISONING =====" >> "$LOGFILE"
|
||||
|
||||
TMPDIR2=$(mktemp -d)
|
||||
echo '{"app":"test","port":8080,"env":{"EVIL":"$(cat /etc/passwd)","SHELL_INJECT":"; rm -rf /","LONG_VAL":"'"$(dd if=/dev/urandom bs=1 count=8000 2>/dev/null | tr -dc 'a-zA-Z0-9')"'"}}' > "$TMPDIR2/.gy.json"
|
||||
echo 'FROM nginx:latest' > "$TMPDIR2/Dockerfile"
|
||||
OUT=$($TIMEOUT_CMD $BIN config --no-auto-update 2>&1)
|
||||
log_test "config with poisoned .gy.json env values" "not execute commands" "$OUT" "$?"
|
||||
|
||||
echo '{"app":99999,"port":"EVIL","publicAccess":{"enabled":"NOTBOOL"}}' > "$TMPDIR2/.gy.json"
|
||||
OUT=$($TIMEOUT_CMD $BIN config --no-auto-update 2>&1)
|
||||
log_test "config with wrong-type .gy.json fields" "error gracefully" "$OUT" "$?"
|
||||
|
||||
echo 'INVALID JSON {{{' > "$TMPDIR2/.gy.json"
|
||||
OUT=$($TIMEOUT_CMD $BIN config --no-auto-update 2>&1)
|
||||
log_test "config with completely broken .gy.json" "error gracefully" "$OUT" "$?"
|
||||
rm -rf "$TMPDIR2"
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "=====================================================================" >> "$LOGFILE"
|
||||
echo "FINAL SUMMARY" >> "$LOGFILE"
|
||||
echo "=====================================================================" >> "$LOGFILE"
|
||||
echo "Total Tests: $TOTAL" >> "$LOGFILE"
|
||||
echo "Passed (no crash): $PASS" >> "$LOGFILE"
|
||||
echo "Failed (crash/panic): $FAIL" >> "$LOGFILE"
|
||||
if [ -n "$FINDINGS" ]; then
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "CRITICAL FINDINGS:" >> "$LOGFILE"
|
||||
printf "$FINDINGS" >> "$LOGFILE"
|
||||
echo "" >> "$LOGFILE"
|
||||
fi
|
||||
echo "=====================================================================" >> "$LOGFILE"
|
||||
|
||||
echo "" >> "$LOGFILE"
|
||||
echo "Test run complete at $(date)" >> "$LOGFILE"
|
||||
|
||||
cat "$LOGFILE"
|
||||
المرجع في مشكلة جديدة
حظر مستخدم